CVE-2026-116590: snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
snappy-javato a version that resolves this vulnerability.Fixed in 1.1.10.9
Event History
Frequently Asked Questions
What conditions are required to trigger the JVM crash?
An attacker or untrusted caller must be able to supply range arguments reaching Snappy.arrayCopy, SnappyOutputStream.rawWrite, SnappyInputStream.rawRead, or their typed-array read/write methods. Exploitation relies on negative or oversized offsets or byte lengths, or on integer overflow in typed-array byte-size calculations.
Are applications using the affected APIs exposed by default?
Exposure depends on whether attacker-controlled input can influence the array ranges passed to these APIs. The vulnerability does not require authentication or user interaction, but the attack complexity is high.
What is the impact if exploitation succeeds?
Unchecked ranges are passed to native memcpy, allowing reads or writes outside Java array bounds and causing the JVM to crash. The stated impact is availability only; no confidentiality or integrity impact is listed.
How can I remediate this issue?
Upgrade snappy-java to version 1.1.10.9, which fixes the issue. If an immediate upgrade is not possible, prevent untrusted values from controlling offsets and lengths and validate that ranges are non-negative and remain within the relevant array bounds.